riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(gateway): allow egress to ingress-nginx for JWKS #70

Merged
rock merged 1 commits from feat/gateway-egress-jwks into main 2026-10-27 08:37:25 +00:00
Conversation 0 Commits 1 Files Changed 2
+13 -1
poimen commented 2026-10-27 08:37:11 +00:00
Member
Copy Link
Copy Source

NetworkPolicy ipBlock 10.96.0.0/12 misses the real service CIDR 10.106.0.0/16. JWKS fetch hung, callers got 403, pod failed liveness. Allow 443 to the ingress-nginx namespace.

NetworkPolicy ipBlock 10.96.0.0/12 misses the real service CIDR 10.106.0.0/16. JWKS fetch hung, callers got 403, pod failed liveness. Allow 443 to the ingress-nginx namespace.
poimen added 1 commit 2026-10-27 08:37:12 +00:00
fix(gateway): allow egress to ingress-nginx for JWKS
CI / CI (pull_request) Successful in 2m20s
Details
CI / CI (push) Successful in 3m20s
Details
67fe20d7a3 
The service CIDR is 10.106.0.0/16, so the ipBlock 10.96.0.0/12 never covered
ingress-nginx (10.101.128.185). The JWKS fetch to zitadel.riotpiao.com therefore
hung until the context deadline: every caller got 403, and the pod failed its
liveness probe before serving traffic.

Add an egress rule for TCP 443 to the ingress-nginx namespace and point jwksUrl
back at the public host. The ZITADEL service port 8080 answers 404 for
/oauth/v2/keys, so the service endpoint is not usable.
rock merged commit 67fe20d7a3 into main 2026-10-27 08:37:25 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code
 priority/high
Must have
 priority/low
Nice to have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#70